Join Log in
Score:0
Marcelo Villa-Piñeros avatar Server

Mimic user permissions on AWS EC2 instances using IAM roles

bq flag
Marcelo Villa-Piñeros

I'm setting up an AWS account with several users. Each of these users has policies attached that restrict their access to specific S3 buckets/objects and the EC2 instance types / Autoscaling Groups they can launch.

Users can launch multiple on-demand / spot instances at any given time. I want to make sure that the instances that a specific user launches have the same permissions or restrictions as the user that launched them. I'm sure I can find a way of setting up the corresponding user credentials on startup but I'd rather use roles for this.

I've been able to create a role and an instance profile to launch an EC2 instance and get S3 access with temporary credentials instead of setting up the user's access key ID and secret access key on that instance. However, is there any way of having the role mimic the user's permission so any instance launched by that user has their same restrictions? Right now a user could simply use this role to launch an EC2 instance and use that instance to access S3 buckets and objects he should not be able to access otherwise. Furthermore, some of the policies use the aws:username variable, which is not available when the principal is an assumed role.

One workaround seems to create user-specific roles with the same policies as the ones attached to the user, but this seems like a bad approach, specially if I have a big number of users that I constantly update permissions for. I'm also unsure if I'm able to restrict users from assuming roles different than their corresponding ones. Lastly, this still would not work for policies that use the aws:username.

What are my options here? What would be a good practice in this scenario?

46
0 + 3
Tim avatar
gp flag
Tim
Interesting question. If users can ssh into an EC2 instance started by someone with higher privileges than themselves it's going to be difficult to restrict permissions using roles. Best practice is to set up a user for each person on each EC2 instance, you don't share the ec2-user login / key. It might be easiest to just set up access keys for each user, though they could still escalate privileges by fetching the instance credentials from the instance metadata. I don't know a technical solution, it might be that you have to have a policy and detect policy violations using CloudTrail logs.
1
Reply
Marcelo Villa-Piñeros avatar
bq flag
Marcelo Villa-Piñeros
@Tim I was also considering creating users in each machine and giving each user it's key to access that machine under their specific user. The caveat is that I'd need to store the AWS credentials somewhere to then pull them in each instance and configure each user's credentials. Roles seem like a better practice than storing keys (even if it's using secure services such as AWS Secrets Manager or HashiCorp's Vault).
0
Reply
Tim avatar
gp flag
Tim
Roles are generally best practice, but privilege escalation is an issue. The simple method would be to prevent anyone sshing into the instances, using something like immutable instances and gold images. If you can manage that the problem becomes much simpler to solve.
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.